rustls ECH Demo

Protocol: TLS (HTTP/2)

ECH status: not offered

SNI (server_name): proxied-b.ech.jelle.dev

Connection path:
Browser —[TLS (HTTP/2)]→ Server

Wire SNI: proxied-b.ech.jelle.dev (plaintext)
No ECH extension was sent.

The client did not include an ECH extension. The SNI was sent in plaintext, visible to network observers.

Demo endpoints

Domain	(h2 + h3)	:444 (h2 only)	Mode
proxied-a	visit	visit	split-mode ECH
proxied-b	visit	visit	split-mode ECH
direct	visit	visit	passthrough ECH
noech	visit	visit	no ECH (GREASE)
public	visit	visit	outer SNI endpoint

= TCP + UDP (browser upgrades to h3 via alt-svc) | :444 = TCP only (no QUIC)